2024-05-04 01:44:14 +02:00
#
2024-06-08 17:40:57 +02:00
# spec file for package velociraptor
2024-05-04 01:44:14 +02:00
#
2024-06-08 17:40:57 +02:00
# Copyright (c) 2024 SUSE LLC
2024-05-04 01:44:14 +02:00
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via https://bugs.opensuse.org/
#
%define flavor @BUILD_FLAVOR@%{nil}
%if "%{flavor}" == "client"
%define build_client 1
%define build_server 0
%define name_suffix -client
%define make_target linux_bare
2024-06-08 17:40:57 +02:00
%define config_perms 0600, root, root
%define state_dir_perms 0700, root, root
2024-05-04 01:44:14 +02:00
%else
%define build_server 1
%define build_client 0
%define name_suffix %{nil}
%define make_target linux
2024-06-08 17:40:57 +02:00
%define config_perms 0640, root, velociraptor
%define state_dir_perms 0700, velociraptor, velociraptor
2024-05-04 01:44:14 +02:00
%endif
%define projname velociraptor
%define vmlinux_h_version 5.14.21150400.22-150400-default
2024-06-08 17:40:57 +02:00
# SLE 15 SP3 / Leap 15.3 or newer gets eBPF
2024-05-04 01:44:14 +02:00
# Earlier versions don't have a usable eBPF and the
# release doesn't easily build llvm13
2024-06-08 17:40:57 +02:00
%if 0%{?suse_version} > 1500 || 0%{?sle_version} > 150200
2024-05-04 01:44:14 +02:00
%bcond_without bpf
2024-06-08 17:40:57 +02:00
%endif
%if "%{_vendor}" == "debbuild"
%bcond_without bpf
%endif
%if 0%{?rhel}
# RHEL can do BPF but we need llvm for it
%bcond_without bpf
%endif
%if "%{_vendor}" == "debbuild"
%define _unitdir /usr/lib/systemd/system
%endif
# Older SLE releases and debbuild don't support uppercase VERSION macro
%if "%{_vendor}" == "debbuild" || 0%{?sle_version} < 150000
2024-08-13 13:11:21 +02:00
%global VERSION %{version}
2024-05-04 01:44:14 +02:00
%endif
#Compat macro for new _fillupdir macro introduced in Nov 2017
%if ! %{defined _fillupdir}
%define _fillupdir %{_localstatedir}/adm/fillup-templates
%endif
# SLE12 has _sharedstatedir in an odd place
%if 0%{?sle_version} >= 120000 && 0%{?sle_version} < 150000
%define _sharedstatedir /var/lib
%endif
Name : velociraptor%{name_suffix}
2024-08-13 13:11:21 +02:00
Version : 0.7.0.4.git97.675e45f9
2024-05-04 01:44:14 +02:00
Release : 0
%if %{build_server}
Summary : Endpoint visibility and collection tool
%else
Summary : Endpoint visibility and collection tool (endpoint only)
%endif
Group : System/Monitoring
License : AGPL-3.0-only
URL : https://github.com/Velocidex/velociraptor
2024-06-08 17:40:57 +02:00
Source : %{projname} -%{version} .tar.gz
Source1 : velociraptor-go_modules.tar.gz
Source2 : vmlinux.h-%{vmlinux_h_version} .tar.xz
Source3 : velociraptor.service
Source4 : velociraptor-server.config.placeholder
Source5 : velociraptor-client.service
Source6 : velociraptor-client.config.placeholder
Source7 : sysconfig.velociraptor
Source8 : sysconfig.velociraptor-client
Source9 : %{projname} .obsinfo
Source10 : system-user-velociraptor.sysusers
Source11 : velociraptor-nodejs.spec.inc
2024-06-12 16:08:34 +02:00
Source12 : package-lock.json
2024-06-08 17:40:57 +02:00
%include %{_sourcedir} /velociraptor-nodejs.spec.inc
Patch1 : vendor-build-fixes-for-SLE12.patch
Patch2 : sdjournal-build-fix-for-SLE12.patch
Patch3 : velociraptor-reproducible-timestamp.diff
2024-06-12 16:08:34 +02:00
# PATCH-FIX-UPSTREAM CVE-2024-28849-follow-redirects-drop-proxy-authorization.patch bsc#1221456 -- follow-redirects: Drop Proxy-Athorization across hosts
2024-06-08 17:40:57 +02:00
Patch4 : CVE-2024-28849-follow-redirects-drop-proxy-authorization.patch
2024-06-12 16:08:34 +02:00
# PATCH-FIX-UPSTREAM CVE-2022-25883-npm-watch-semver-deps.patch bsc#1212572 -- upgrade npm-watch
Patch5 : CVE-2022-25883-npm-watch-semver-deps.patch
2024-05-04 01:44:14 +02:00
BuildRequires : fileb0x
2024-06-08 17:40:57 +02:00
%if 0%{?suse_version}
2024-05-04 01:44:14 +02:00
BuildRequires : systemd-rpm-macros
2024-06-08 17:40:57 +02:00
BuildRequires : golang(API) >= 1.19
BuildRequires : pkgconfig(libsystemd)
%endif
%if "%{_vendor}" == "debbuild"
BuildRequires : golang >= 2:1.19~0
BuildRequires : libsystemd-dev
BuildRequires : pkg-config
%endif
%if 0%{?rhel}
BuildRequires : golang >= 1.19
BuildRequires : python3
BuildRequires : systemd-devel
2024-05-04 01:44:14 +02:00
BuildRequires : pkgconfig(libsystemd)
2024-06-08 17:40:57 +02:00
%endif
2024-05-04 01:44:14 +02:00
%if %{build_server}
2024-06-08 17:40:57 +02:00
BuildRequires : local-npm-registry
2024-05-04 01:44:14 +02:00
BuildRequires : nodejs >= 18
BuildRequires : npm >= 18
%endif
%if %{with bpf}
2024-06-08 17:40:57 +02:00
%if 0%{?suse_version}
2024-08-13 13:11:21 +02:00
%if 0%{?suse_version} > 1500 || 0%{?sle_version} == 150600
BuildRequires : clang17
BuildRequires : llvm17
%else
%if 0%{?sle_version} >= 150300
2024-05-04 01:44:14 +02:00
BuildRequires : clang16
2024-06-08 17:40:57 +02:00
BuildRequires : llvm16
%if 0%{?sle_version} > 150400
BuildRequires : llvm16-libclang13
%endif
%else
BuildRequires : clang13
BuildRequires : llvm13
%endif
2024-08-13 13:11:21 +02:00
%endif
2024-05-04 01:44:14 +02:00
BuildRequires : libelf-devel
BuildRequires : libzstd-devel
2024-06-08 17:40:57 +02:00
BuildRequires : zlib-devel
%endif
%if "%{_vendor}" == "debbuild"
BuildRequires : clang
BuildRequires : libelf-dev
BuildRequires : libzstd-dev
BuildRequires : llvm
BuildRequires : zlib1g-dev
%endif
%if 0%{?rhel}
BuildRequires : clang >= 13
BuildRequires : libelf-devel
2024-05-04 01:44:14 +02:00
BuildRequires : libzstd-devel
2024-06-08 17:40:57 +02:00
BuildRequires : llvm >= 13
2024-05-04 01:44:14 +02:00
BuildRequires : zlib-devel
%endif
2024-06-08 17:40:57 +02:00
%endif
2024-05-04 01:44:14 +02:00
%if %{build_server}
2024-08-13 13:11:21 +02:00
BuildRequires : group(velociraptor)
2024-06-08 17:40:57 +02:00
Requires : group(velociraptor)
Requires : user(velociraptor)
Obsoletes : velociraptor-kafka-humio-gateway < %{version}
2024-08-13 13:11:21 +02:00
%else
%if 0%{?suse_version}
BuildRequires : sysuser-tools
2024-05-04 01:44:14 +02:00
%{?sysusers_requires}
%endif
2024-08-13 13:11:21 +02:00
%endif
2024-05-04 01:44:14 +02:00
2024-06-08 17:40:57 +02:00
%if 0%{?suse_version}
2024-08-13 13:11:21 +02:00
# SLE12 doesn't support sysusers
%if 0%{?sle_version} >= 120000 && 0%{?sle_version} < 150000
2024-06-08 17:40:57 +02:00
Requires(pre) : pwdutils
%define pre_create_group 1
%else
Requires : group(velociraptor)
%endif
%endif
%if %{build_server}
%if 0%{?suse_version} > 1500 || 0%{?sle_version} >= 150400
ExclusiveArch : x86_64
%else
ExclusiveArch : do_not_build
%endif
%else
ExclusiveArch : x86_64 ppc64le aarch64 s390x
%endif
%if 0%{?rhel}
# RHEL builds aren't working yet
ExclusiveArch : do_not_build
%endif
# Not *required* but without it, we spam the system log
Recommends: auditd
%if 0%{?_project:1} && (0%{?suse_version} > 1500 || 0%{?sle_version} > 150000)
Provides : %{name} (project:%_project)
%endif
%if "%{vendor}" == "debbuild"
%define mtag Packager: https://www.suse.com
%mtag
%endif
2024-05-04 01:44:14 +02:00
%if %{build_server}
%description
Velociraptor is a tool for collecting host based state information
using The Velociraptor Query Language (VQL) queries.
To learn more about Velociraptor, read the documentation on:
https://docs.velociraptor.app/
This package contains the velociraptor server and full console GUI.
For just the endpoint agent, please install the 'velociraptor-client' package.
%endif
%if %{build_client}
%description
Velociraptor is a tool for collecting host based state information
using The Velociraptor Query Language (VQL) queries.
To learn more about Velociraptor, read the documentation on:
https://docs.velociraptor.app/
This package contains only the endpoint agent. For the full server and GUI
console, please install the 'velociraptor' package.
2024-08-13 13:11:21 +02:00
%if 0%{?suse_version}
%package -n system-user-velociraptor
Summary : System user and group 'velociraptor'
Version : 1.0.0
License : Apache-2.0
Group : System/Monitoring
Provides : group(velociraptor)
Provides : user(velociraptor)
BuildArch : noarch
%description -n system-user-velociraptor
This package provides a shared system user for all velociraptor components
%endif
2024-05-04 01:44:14 +02:00
%endif
%prep
2024-06-08 17:40:57 +02:00
%setup -q -a 1 -a 2 -n %{projname} -%{VERSION}
%patch -P 1 -p1
%patch -P 2 -p1
%patch -P 3 -p1
2024-06-12 16:08:34 +02:00
%patch -P 4 -p1
%patch -P 5 -p1
2024-05-04 01:44:14 +02:00
# Set the version to something more specific than <next-tag>-dev
2024-06-08 17:40:57 +02:00
sed -ie " s / \ ( [ [ : s p a c e : ] ] V E R S I O N * = \ ) . * / \1 \" %{VERSION} \" / " constants/constants.go
2024-05-04 01:44:14 +02:00
%if %{with bpf}
mkdir -p third_party/libbpfgo/output
2024-06-08 17:40:57 +02:00
arch=%{_arch}
if test " $ a r c h " = " a m d 6 4 " ; then
arch=x86_64
fi
cp vmlinux.h-%{vmlinux_h_version} /vmlinux-${arch}.h \
2024-05-04 01:44:14 +02:00
third_party/libbpfgo/output/vmlinux.h
%endif
# These just clutter the GUI and we don't have Windows clients
# Note: There are dependencies on these that need to be resolved before
# removing them outright.
# rm -rf artifacts/definitions/Windows
2024-06-08 17:40:57 +02:00
%if %{build_server}
pushd gui/velociraptor
rm -f package-lock.json
2024-06-12 16:08:34 +02:00
local-npm-registry %{_sourcedir} install --include=dev --legacy-peer-deps
2024-06-08 17:40:57 +02:00
popd
%endif
2024-05-04 01:44:14 +02:00
%build
2024-06-08 17:40:57 +02:00
# Reproducible builds need stable timestamps
timestamp=$(date -Iseconds --utc --date=@$(grep mtime: %{SOURCE9} |sed -e 's/mtime: //' ))
git_commit=$(grep commit: %{SOURCE9} |sed -e 's/commit: //g' )
2024-05-04 01:44:14 +02:00
export VELOCIRAPTOR_BUILD_TIME=$timestamp
export VELOCIRAPTOR_GIT_HEAD=$git_commit
%if %{build_server}
(cd gui/velociraptor ; npm run build)
2024-08-13 13:11:21 +02:00
%else
%if 0%{?suse_version}
2024-06-08 17:40:57 +02:00
%sysusers_generate_pre %{SOURCE10} velociraptor-user
2024-05-04 01:44:14 +02:00
%endif
2024-08-13 13:11:21 +02:00
%endif
2024-05-04 01:44:14 +02:00
2024-06-08 17:40:57 +02:00
%if 0%{?suse_version}
LLVM_STRIP=llvm-strip
%else
LLVM_STRIP=llvm-strip
2024-05-04 01:44:14 +02:00
%endif
2024-06-08 17:40:57 +02:00
CLANG=clang
PATH=$PATH:/usr/sbin make %{make_target} BUILD_BPF_PLUGINS=%{with bpf} CLANG=$CLANG STRIP=$LLVM_STRIP
2024-05-04 01:44:14 +02:00
%install
install -D -d -m 0750 %buildroot/%{_sysconfdir} /velociraptor
install -D -d -m 0700 %buildroot/%{_sharedstatedir} /%{name} /data
install -D -d -m 0700 %buildroot/%{_sharedstatedir} /%{name} /logs
install -D -d -m 0700 %buildroot/%{_sharedstatedir} /%{name} /tmp
%if %{build_server}
2024-06-08 17:40:57 +02:00
service_file_source=%{SOURCE3}
config_file_source=%{SOURCE4}
sysconfig_file_source=%{SOURCE7}
2024-05-04 01:44:14 +02:00
config_file=server.config
%else
2024-08-13 13:11:21 +02:00
%if 0%{?suse_version}
install -D -m 0644 %{SOURCE10} %{buildroot} %{_sysusersdir} /system-user-velociraptor.conf
%endif
2024-06-08 17:40:57 +02:00
service_file_source=%{SOURCE5}
config_file_source=%{SOURCE6}
sysconfig_file_source=%{SOURCE8}
2024-05-04 01:44:14 +02:00
config_file=client.config
%endif
2024-06-08 17:40:57 +02:00
%if 0%{?suse_version}
2024-05-04 01:44:14 +02:00
install -D -m 0644 " $ s y s c o n f i g _ f i l e _ s o u r c e " %{buildroot} %{_fillupdir} /sysconfig.%{name}
%endif
2024-06-08 17:40:57 +02:00
%if "%{vendor}" == "debbuild"
install -D -m 0644 " $ s y s c o n f i g _ f i l e _ s o u r c e " %{buildroot} /%{_sysconfdir} /default/%{name}
%endif
install -D -m 0644 " $ s e r v i c e _ f i l e _ s o u r c e " %{buildroot} %{_unitdir} /%{name} .service
install -D -m 0640 " $ c o n f i g _ f i l e _ s o u r c e " " %{buildroot} %{_sysconfdir} / v e l o c i r a p t o r / $ c o n f i g _ f i l e "
install -D -m 0755 output/velociraptor-v%{VERSION} -linux-* %buildroot/%{_bindir} /%{name}
2024-05-04 01:44:14 +02:00
%files
%defattr (-, root, root)
%license LICENSE
%doc README.md
%{_bindir} /%{name}
%{_unitdir} /%{name} .service
2024-06-08 17:40:57 +02:00
%if 0%{?suse_version}
2024-05-04 01:44:14 +02:00
%{_fillupdir} /sysconfig.%{name}
2024-06-08 17:40:57 +02:00
%endif
%if "%{vendor}" == "debbuild"
%{_sysconfdir} /default/%{name}
%endif
2024-05-04 01:44:14 +02:00
%dir %attr (-, root, velociraptor) %{_sysconfdir} /velociraptor
2024-06-08 17:40:57 +02:00
%config (noreplace) %attr (%{config_perms} ) %{_sysconfdir} /velociraptor/*.config
%dir %attr (%{state_dir_perms} ) %{_sharedstatedir} /%{name}
%dir %attr (%{state_dir_perms} ) %{_sharedstatedir} /%{name} /data
%dir %attr (%{state_dir_perms} ) %{_sharedstatedir} /%{name} /logs
%dir %attr (%{state_dir_perms} ) %{_sharedstatedir} /%{name} /tmp
2024-05-04 01:44:14 +02:00
2024-08-13 13:11:21 +02:00
%if %{build_client}
%if 0%{?suse_version}
2024-06-08 17:40:57 +02:00
%files -n system-user-velociraptor
%defattr (-, root, root)
%{_sysusersdir} /system-user-velociraptor.conf
%pre -n system-user-velociraptor -f velociraptor-user.pre
%endif
2024-08-13 13:11:21 +02:00
%endif
2024-06-08 17:40:57 +02:00
%if 0%{?suse_version}
2024-05-04 01:44:14 +02:00
%pre
2024-06-08 17:40:57 +02:00
%if 0%{?pre_create_group}
# create velociraptor group if it doesn't exist
groupadd -f -r velociraptor 2>/dev/null || :
%endif
2024-05-04 01:44:14 +02:00
%service_add_pre %{name} .service
%post
%{fillup_only}
%service_add_post %{name} .service
%preun
%service_del_preun %{name} .service
%postun
%service_del_postun %{name} .service
%endif
2024-06-08 17:40:57 +02:00
%if "%{_vendor}" == "debbuild"
%postun
# Automatically added by dh_installsystemd/13.11.4
if [ " $ 1 " = remove ] && [ -d /run/systemd/system ] ; then
systemctl --system daemon-reload >/dev/null || true
fi
# End automatically added section
# Automatically added by dh_installsystemd/13.11.4
if [ " $ 1 " = " p u r g e " ]; then
if [ -x " / u s r / b i n / d e b - s y s t e m d - h e l p e r " ]; then
deb-systemd-helper purge 'velociraptor-client.service' >/dev/null || true
fi
fi
# End automatically added section
2024-05-04 01:44:14 +02:00
%endif
%changelog